Access to health records

Question and answer about health records

-Automatic translation

A health record is a collection of health data about an individual, prepared in connection with treatment or acquired from elsewhere in connection with treatment at a healthcare institution or the premises of a self-employed healthcare professional. Health records shall include written descriptions or interpretations, images, including x-rays, graphical data, and video and audio recordings containing information regarding a patient's health and treatment provided by a healthcare professional or healthcare facility, and other necessary personal data.

In entering and storing health records and access to them, the patient’s human integrity and right to self-determination shall be respected, considering that health records contain sensitive personal information and that health data are confidential.

Health Records Act.

-Automatic translation

A health record is stored in the health information system of healthcare facilities or on the premises of self-employed healthcare practitioners. These parties are the guardians of the health records and are responsible for the storage of health records and that it is consistent with the provisions of the Health Records Act. The guardians of health records shall store them until they are handed over to the Directorate of Health or the National Archives of Iceland.

-Automatic translation

The supervisor of health records is a physician or another healthcare practitioner, if no physician is available, appointed by the guardian to supervise the entry and handling of information in health records and to ensure that they are consistent with the provisions of the Health Records Act. Healthcare practitioners who work alone on their premises is deemed to be the supervisor of health records they enter.

Further information on guardians of health records in answer no. 2.

-Automatic translation

When you receive treatment, you or your representative can decide that health records with respect to the treatment shall not be accessible to others than the person making the entry and the supervisor of the health records and, as applicable, other specified healthcare practitioners. Should it be deemed necessary concerning treatment that other healthcare practitioners have access to the health data in question, you shall be informed of this and also informed that refusal to authorise necessary access to the health record may be equivalent, under some circumstances, to refusal of treatment, cf. the Patient’ Rights Act.

If you or your representative believe that health records are wrong or misleading, your comment shall be entered into the health record. Should it be demonstrated that information in the health record is inaccurate or misleading, it is permissible, with the consent of the supervisor, to correct the information in the health record of the individual, provided that it is ensured that information that could be relevant to legal disputes is not lost.

If the supervisor refuses to correct health records regarded by the patient as clearly wrong or misleading, the patient may appeal that refusal to the Medical Director of Health. Deletion of information from a patient’s health record is prohibited except with the permission of the Medical Director of Health. Decisions of the Medical Director of Health on the correction or deletion of health records are final at the administrative level and may not be appealed to the Minister.

-Automatic translation

Deletion of information from a patient’s health record is prohibited except with the permission of the Medical Director of Health. It must be demonstrated that information in the health record is wrong or misleading for it to be considered for deletion. This authorisation is interpreted narrowly, which means that quite a lot has to happen for entries to be deleted.

Requests for deleting information in health records must be directed to the supervisor of the health record, and a clear and reasoned account of the request must be provided. More information about the supervisor of the health record in answer to question 3.

If the supervisor agrees to the request, he sends a report to the Directorate of Health and the necessary supporting documents explaining the case before the information is deleted. If the supervisor does not agree to delete the data, he must respond in writing and point out that the refusal may be appealed to the Directorate of Health. Decisions of the Medical Director of Health on deleting health records are final at the administrative level and may not be appealed to the Minister.

-Automatic translation

You or your representative have the right to access your health records in whole or in part and be given copies upon request. Such a request shall be made to the health records supervisor.

In case of health data acquired from sources other than yourself or healthcare practitioners, consent from the source of the information will be given before the record is shown to you. Suppose the source of information on a patient is deceased or refuses on unreasonable grounds to provide consent. In that case, the Medical Director of Health may decide that you or your representative be granted access to the data in question, in whole or in part.

Refusal of the health records supervisor on your access to your health record may be appealed to the Medical Director of Health. Decisions of the Medical Director of Health on access to health records are final at the administrative level and may not be appealed to the Minister.

-Automatic translation

Healthcare practitioners who are involved in a patient’s treatment and require their health records in connection with the treatment shall have access to the patient’s health records, with the restrictions arising from the provisions of the Health Records Act. A supervisor of health records can grant other staff and students undergoing clinical training in healthcare sciences who have undertaken the obligation of confidentiality comparable to that of healthcare practitioners and are involved in the patient’s treatment, access their health records in so far as this is necessary for their work in the patient’s interest.

Access to especially sensitive health data, i.e., health data that the patient believes
should be classified as such, shall be restricted to healthcare practitioners who necessarily require access in relation to the patient's treatment. Access to especially sensitive health data shall generally be limited to those healthcare practitioners working within the unit or department of healthcare facilities or on the premises of self-employed healthcare practitioners where the treatment is provided. Access by other healthcare practitioners to especially sensitive health data is prohibited, except with the patient’s consent. An exception may be made from the above-mentioned access restrictions if deemed necessary for the security of healthcare practitioners.

-Automatic translation

You or your representative may prohibit a specific member or specific members of staff, including students undergoing clinical training, from accessing your health records. Should it be deemed necessary, however, concerning treatment, that the specified member/members of staff or students have access to the health data in question, you shall be informed of this and also informed that refusal to authorise necessary access to the health record may be equivalent, under some circumstances, to refusal of treatment, cf. the Patients’ Rights Act.

Healthcare staff has undertaken an obligation of confidentiality concerning the personal information they become aware of in their work, including health record data.

-Automatic translation

In principle, access to health records is not permitted unless a special legal authority says otherwise.

For imperative reasons, a health records supervisor may grant a close relative of a deceased individual, such as the spouse, a parent, or a descendant, access to the deceased’s health records. When assessing whether access shall be granted to a health record of a deceased individual, consideration shall be taken to the relative’s interests requesting such access and to the wishes of the deceased if they are at hand. A request for access to a deceased person's health record should be directed to the supervisor of the health record where the deceased received health care. In the case of Landspítali, access can be requested at Request for a copy of the medical records of relatives - Landspítali (Icelandic). The health record might have been handed over to the National Archives of Iceland. It is essential to support the request with arguments. More information on the supervisor of health records in answer to question 3.

Suppose a health records supervisor denies access to or a copy of a deceased individual’s health record. In that case, the supervisor shall guide the right to appeal that refusal to the Medical Director of Health. Decisions of the Medical Director of Health on access to health records are final at the administrative level and may not be appealed to the Minister.

Healthcare authorities who, by law, receive for consideration a complaint or appeal from a patient or their representative with respect to treatment are entitled to access the person’s health records in the same manner as the patient.

Access to health records for scientific studies is subject to the Act on Scientific Research in the Health Sector. A patient or their representative may prohibit their health data from being stored as identifiable in a health databank for use in scientific research, which shall be noted in their record.

-Automatic translation

Guardians and supervisors of health records must ensure that the entry and handling of information are consistent with the provisions of the Health Records Act. A health records supervisor has the right to access health records to the extent necessary for the supervision. More information on the guardian and supervisor of health records in answers to questions 2 and 3.

The Medical Director of Health monitors, as applicable, compliance with the provisions of the Health Record Act. Suppose the patient believes, for example, that a healthcare practitioner has gathered information from their health record or has violated confidentiality. In that case, they can send a complaint to the Directorate of Health.

Data Protection Authority monitors the security and processing of personal data in health records by the provisions of the Act on the Protection of Privacy as regards the Processing of Personal Data (Data Protection Act).

Should monitoring reveal a real likelihood that the personal privacy rights of a patient have been violated, the offence shall be reported to the police.

-Automatic translation

Autopsies are divided into forensic autopsies and other autopsies performed in hospitals. In the case of other autopsies, the autopsy report is part of the deceased's health record. A forensic autopsy is carried out at the decision of the police, and it is kept by the police.

Health records, including autopsy reports, are preserved where the health record is entered. More information in answer to question 2.

Access to the health record of a deceased person is discussed in the answer to question 10.